Tag Info

Hot answers tagged

18

This won't work for many websites. Many websites use virtual hosts where they host websites for multiple domains from a single webserver. In this case, the only way they know what site you're coming from is by the hostname your browser sends in the Host header of the HTTP request. The way to do this would be to specifically add these entries into your ...


12

DNSSec is normal DNS, but with signatures. It absolutely prevents DNS Spoofing; that's what it's for, and that's what it does. Registrars can still theoretically abuse their position because they're responsible for communicating your intentions to the root servers. This includes information about your DNSSec keys. This relationship will never change; if ...


12

DNSSEC and DNSCurve address completely different aspects of DNS security. First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects ...


11

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (a zone) to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Master DNS server, and Slave DNS servers, and the slave asks he master for a copy of the records for that zone. A basic DNS Zone ...


9

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


9

Since DNS usually runs over UDP, response packets can be readily spoofed. UDP packets are identified by the combination of source and destination IP address and source and destination port numbers. The classic DNS poisoning attack is to send a DNS server a query which you think will cause the server to do a recursive lookup, and then blast away at the ...


8

The "Kaminsky bug" (CVE-2008-1447) affects "BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1".


8

Most likely not. IPv6 support is still quite patchy in many parts of the world. The delay is most likely caused by bad routing or network packets having to go through too many hops. You can test out your IPv6 connection here. The hosts file is used to bypass DNS and make your access to websites matching domains listed slightly faster, not slower. A whois ...


7

Let's suppose that someone (Mario) wants to send an email to someone else (let's call him Nicolas). Nicolas' mailbox is filled by a unique server, let's say smtp.gouv.fr (that's a fictitious example). So, whatever Mario does, the email will have to go through that server, transmitted with the SMTP protocol (the one with the 'RCPT' command). Mario would like ...


7

Despite what Wikipedia may say, they are not the same. Roughly speaking, DNS cache poisoning is one way to do DNS spoofing, but there are other ways to do it, too. DNS spoofing refers to the broad category of attacks that spoof DNS records. It is a category of attacks (an end goal of the attack, rather than a particular attack mechanism). There are many ...


6

We can but... At the point the query makes it to your server it's already too late. Your server will waste its resources trying to do something with the packets and the requests. Even if you have something like iptables drop all connections it's still going to use up all of the bandwidth on the server inbound. Redirecting all traffic someplace else eats up ...


5

This is very dangerous. If someone has control over your DNS they can, for example, steal all your email or your web traffic. First, do you operate your own DNS servers, or are they hosted (e.g. at a hosting provider or at your registrar)? Hosted: Check the control panel for these extra entries. They may be prepopulated to point to the host's servers. If ...


5

This is a genuine Microsoft Update site. If you go to any Microsoft KB article you'll see the link in the INTRODUCTION section (example). All old Windows Update addresses such as windowsupdate.microsoft.com and windowsupdate.com now redirect to the new update.microsoft.com. The new domain seems to be a policy of unifying the update site for Microsoft's ...


4

To complete what @Adnan says: yes, the page is legitimate, however, it is an HTTP-only page, so it could potentially be hijacked (without HTTPS, attackers have ways to present you with fake pages), although it is rather unclear what an attacker could gain that way. Either way, using the menu entry to reach the update site is safe from external interference ...


4

Suppose foo.com has the IP address 11.11.11.11. With DNS spoofing, you worry that foo.com will not correctly resolve to 11.11.11.11, because an attacker has fooled you into thinking its IP address is 22.22.22.22. In this case, your problem is that the domain record you have doesn't point to the IP address you really want. Now, imagine you always enter ...


4

From looking at the source, I am going to wager that one potential reason is due to the fact that the user has the option to spoof the source IP address that is sending the malicious DNS requests and responses. If one was using the target name server to retrieve information, they would need to make requests from their true IP in order to receive responses. ...


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...


4

You might have hit the "Google Global Cache" where servers are placed on your ISPs network to provide lower-latency access to commonly used resources. The fact that visiting that IP address in a browser gives the Google search page reinforces this likelihood. As for trusting IP addresses: don't. Always use protocols protected by strong end-to-end ...


3

The problem is that you need to drop the traffic before it reaches your network. So even when dropping packets at your server is way too late. The best way to reduce risk is to use packet scrubbing services like Akamai or Cloudfare who have DDoS mitigation techniques in place to prevent this traffic from reaching your network.


3

DNS Amplification attacks are very easy to prevent by filtering UDP packets at the edge routers. This is how Cloudflare is able to easily thwart a 300+ gb/s DDoS attack.


3

Blocking the traffic on the server will not stop the DDoS from eventually saturating its uplink and possibly other links within the network. DNS amplification attacks are all about generating large amounts of bandwidth.


3

Obviously the implications are going to be implementation-dependent. The NAT device is free to choose any source port desired, and some implementations may have historically used sequential port numbering. But with newer hardware this is becomming increasingly unlikely. Specifically, newer routers prefer to use the client computer's original source port ...


3

Blocking IP with no reverse DNS means punishing people who have bad ISP. It seems that most ISP have now understood that reverse DNS should be in place, but occasional mishaps still happen. There is no, to my knowledge, "legitimate" reason not to implement reverse DNS, but I have seen it happen a lot, and rejecting requests on that ground seems harsh, and ...


3

@GrahamHill already explained a zone transfer pretty good already, but I'll try to fill inn some more. By being able to query for all records from the DNS server, the attacker can easily determine which machines are accessible. The zone transfer may reveal network elements that is accessible from the Internet, but that a search engine like Google ...


3

In a technical sense, DNS is easy to spoof. It (almost always) uses UDP as the transport protocol, which is trivial to spoof compared to TCP. And DNS itself offers no precautions against spoofing, so if the attacker can return their own packet first, they win. Note that DNSSEC is designed to address this issue and a couple of others. Successful DNS ...


3

The Open Resolver Projects tries to find recursive DNS servers which have no access lists to restrict which clients can use the nameserver. Nameservers like these can be used for DNS amplification attacks because they can be mislead using spoofed IP addresses for DNS queries. The attacker forges the source of the query to the address of its victim. The ...


3

Many DSL modems are open from the WAN side for use by the telecompanies (you can try telneting from the wan side and see if it's open on your modem, try default username/passwors [1]), while it could have been the ISP that changed the DNS-servers it seems unlikely as the IPs are not in the same range. Like you said, the most likely intrusion vector is a ...


3

DNS requests and replies are not HTTP; they are... DNS. See the standard. Most of the time, DNS requests and responses use UDP: the request is a single IP packet, and so is the response. With UDP, each packet is identified by: the source IP address the destination IP address the source port the destination port A DNS request from client C to DNS server ...


3

Yes, DNSSEC is immune to this kind of attack. Starting at an anchor (usually the root, sometimes DLV), every delegation is either explicitly secure (presence of DS set on delegation): powerdns.com. 172800 IN NS powerdnssec1.ds9a.nl. powerdns.com. 172800 IN NS powerdnssec2.ds9a.nl. powerdns.com. 86400 IN DS 44030 8 3 ...


3

These days Google uses HTTPS even for their search, which makes it relatively easy for you to verify that your connection is secure. This does not absolutely grantee that your connection isn't being rerouted by an attacker, but it does guarantee they're not able to view or manipulate your traffic and therefore the attacker would have little motivation to do ...



Only top voted, non community-wiki answers of a minimum length are eligible